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DETAILED ACTION 

Specification 

1 . The abstract of the disclosure is objected to because "is" should be "are" in the 
second line. Correction is required. See MPEP § 608.01(b). 

Claim Rejections - 35 USC §112 

2. The following is a quotation of the second paragraph of 35 U.S.C. 1 1 2: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

3. Claims 1-9 are rejected under 35 U.S.C. 1 12, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

4. Claim 1 recites the limitation "the signature" in the fifth line. There is insufficient 
antecedent basis for this limitation in the claim. Change "the" to "a". 

Claim Rejections - 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

6. Claims 1, 3, and 6-16 are rejected under 35 U.S.C. 102(b) as being anticipated 
by Chen et al. (5832208). 

In figure 3, Chen et al. present a method for removing viruses from e-mail 
messages. Element 235 anticipates scanning an e-mail message, and hence the data 
packets from which the message is made. Lines 1 1-17 of column 5 indicate that the 
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messages can be flowing over the Internet. Thus, the first clause of claim 1 is 
anticipated. Element 200, which detects attachments, anticipates the third clause. 
Element 215, which detects viruses, anticipates detecting a known virus. Signature 
recognition, and hence the entire scope of the second clause, is taught in lines 46-52 of 
column 2. Element 255 deletes infected attachments, which is a form of bit alteration 
that inoculates the e-mail. Element 270, which is used to "cure" the attachment, would 
also affect some alteration of the attachment's bits. Either element anticipates the final 
clause of the first claim. 

The agent, element 110, and the discussion in lines 18-67 of column 5 and lines 
1-8 of column 6 anticipate claim 3. Line two of column 6 specifically says that the agent 
operates in real-time. Chen et al.'s focus on attachments as containing viruses 
anticipates claim 6. Claims 7 and 8 are anticipated by Chen et al.'s mention of virus 
signatures. Figure 3 makes clear that data is recognized as e-mail before being 
scanned for viruses. Claim 10 is a device for performing claims 1, 3, and 7. Claims 12 
and 14 are anticipated by the discussion of periodic scanning in 57-60 of column 5. The 
limitations of claims 1 1 and 15 are met by element 215, which is not described as being 
limited in its scanning powers. Claim 13 is anticipated because e-mails include a variety 
of data, date and time of transmission, sender, recipient, etc., that uniquely identifies an 
e-mail message. Claim 16 is anticipated by the description of virus detection by 
signature comparison. 
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Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

8. Claim 2 is rejected under 35 U.S.C. 103(a) as being unpatentable over Chen et 
al. in view of Templeton (6401210). 

Chen et al. present a system that cures virus-ridden e-mail messages. They do 
not say that the cure is to write over the virus with a predetermined value. In lines 36-37 
of column 1 , Templeton teaches writing over a virus with a string of zeros as a 
technique to cure a document. Therefore it would have been obvious to a person of 
ordinary skill in the art at the time the invention was made to cure the e-mail in Chen et 
al. according to the well-known technique taught by Templeton. 

9. Claims 4 and 5 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Chen et al. in view of Kuo et al. (6230288). 

Chen et al. present a system that cures virus-ridden e-mail messages. Chen et 
al. specifically teach analyzing e-mail attachments, not the text of the e-mail. Kuo et al. 
mention that a virus can now be implemented in ASCII text; ASCII text is used to create 
e-mail text. Therefore it would have been obvious to a person of ordinary skill in the art 
at the time the invention was made for Chen et al. to combat the problem taught by Kuo 
et al. by scanning ASCII text in the e-mails. 
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10. Claims 17 and 18 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Chen et al. 

Chen et al. present a system that cures virus-ridden e-mail messages. Chen et 
al. check potentially infected data against known signatures. The known signatures 
comprise a database. Chen et al. do not say that the database is recompiled at a 
server upon an update or that the update is sent directly to the database for update. 
Official notice is taken that it is old and well-known to recompile a database at host and 
reload the entire database and to add new entries to a database directly. While the 
latter is more efficient in that there is less data transmitted, the former guards against 
the degradation of the database. Therefore it would have been obvious to a person of 
ordinary skill in the art at the time the invention was made for Chen et al. to update the 
virus signatures by either receiving specific updates or by receiving replacement lists of 
virus signatures. 

Conclusion 

1 1 . The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure: O'Neal et al. (6640242) - lines 44-58 of column 21; Dickinson, III 
et al. (6609196) - lines 49-67 of column 5; Hypponen et al. (6577920) - entire 
document and especially the paragraph spanning columns 1 and 2; O'Neal (641 1685) - 
lines 48-62 of column 6; Schneider et al. (6408336) - ASCII viruses, paragraph 
spanning column 41 and 42; Maher, III et al. (6381242) - same inventor and filing date 
as the current application and thus not prior art; Hodges et al. (6269456) - entire 
document and especially lines 33-55 of column 1. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Douglas J. Meislahn whose telephone number is (703) 
305-1338. The examiner can normally be reached on between 9 AM and 6 PM, 
Monday through Thursday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gregory A. Morse can be reached on (703) 308-4789. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 
872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Examiner 
Art Unit 2137 

DJM 




